Older, but still a goodie.

Bruce Schneier, whom I've met once, had an essay last year on the state of the art of password guessing. Not cracking, ala rainbow tables, but guessing. If you want to generate passwords that are better cracked than guessed, this is the essay for you.